// GeminiHIGH
A high-severity vulnerability (CVE-2026-0628) in Chrome's Gemini AI feature allows malicious browser extensions to inject scripts into privileged pages and access user resources like webcams and files without authorization. The flaw stems from insufficient policy enforcement in the Gemini panel browser component. Discovered by Palo Alto Networks researcher Gal Weizman and privately reported to Google in October 2025, a patch was released in January 2026 for Chrome versions 143.0.7499.192/.193 (Windows/macOS) and Linux users are advised to update immediately.
- Chrome Gemini AI flaw CVE-2026-0628 could let extensions access (opens in a new tab)
- Major Gemini AI bug CVE-2026-0628 affects Google Chrome before 1(opens in a new tab)
// Get alerts for Gemini